The Principal Security Engineer (Generalist) is a high-impact, senior leadership role within the Cybersecurity Advisory and Consulting Center of Excellence (COE). Operating as a trusted technical authority, this individual bridges the gap between deep technical security engineering, modern solution architecture, and strategic risk governance.
Rather than specializing in a single silo, the successful candidate possesses a broad, holistic understanding across multiple technology and security domains—including
cloud security (multi-cloud), application security, identity & access management, and threat modeling.
Central to this role is a solid risk management capability and the ability to undertake comprehensive, security-based risk assessments. As a consulting-focused Security Leader, you will drive consulting-led, risk-based control design, working collaboratively across blended product and platform teams. Your focus is to ensure that security controls are engineered-by-design, proportionate to risk, and compliant with rigorous financial regulations (such as APRA CPS 234 and CPS 230) and global frameworks (such as NIST CSF) while actively supporting the organization's overarching business and security objectives.
Requirements
Key Responsibilities and Accountabilities
Security Engineering, Architecture & Solution Design
- Secure Patterns & Blueprints: Lead the design, implementation, and maintenance of enterprise-grade, secure-by-default design patterns and blueprints (such as Zero Trust reference architectures) to enable rapid, secure engineering across product teams.
- Multi-Cloud Security: Define and govern secure landing zones, network security controls (e.g., VPC Service Controls, micro segmentation), and secure configuration standards across hybrid- and multi-cloud environments (primarily AWS and GCP/GCVE).
- Technology Assessment & AI Governance: Establish security guardrails, risk assessments, and secure usage patterns for emerging technologies, including developer environments, GenAI/AI-assisted coding tools, and SaaS marketplace integrations.
- Security Automation & CI/CD Guardrails: Partner with DevSecOps and Platform Engineering to automate secure "front door" and self-service delivery processes, embedding automated scanning (SAST/DAST/SCA), secrets discovery, and compliance checks into build pipelines to reduce developer friction.
- Collaborative Threat Modeling: Lead architectural reviews and threat modeling sessions for high-risk, complex enterprise applications and integration patterns, converting threats into clear, actionable engineering requirements
#J-18808-Ljbffr
Principal Security Engineer in Melbourne employer: XPT Software
XPT Software is an exceptional employer, offering a dynamic work culture that fosters innovation and collaboration in the field of AI governance. Located at the heart of Defence operations, employees benefit from unique opportunities to engage with industry leaders and contribute to meaningful projects that enhance national security. With a strong focus on professional development, XPT Software supports employee growth through continuous learning and mentorship, making it an ideal place for those looking to make a significant impact in their careers.
